T-207 recognition in CIS VFT systems

Some days ago I heard some CIS VFT systems and in particular one of them, a six  100Bd/120Hz channels, caught my attention. I already logged it but sent its main parameters as speed, modulation and shift, to my friend Karapuz asking if he knew the real name of that signal or the name of the modem. He told me that in last January he had just the same receptions and pointing an interesting discussion in radioscanner.ru about the encryption/coding used in such signals: T-207.  Although radioscanner is entirely in Russian, reading the opinion of the expert analyzers from this forum was interesting and I could figure out how detect the T-207 presence. In this post I describe the way I sought its "signature" in some CIS VFT signals as:

a) 3 x 100Bd/1440Hz VFT system
b) 6 x 100Bd/120Hz VFT system

replicating the experiences seen in radioscanner.ru and getting the expected results. 
By the way, these VFT systems are easy to receive (with good strength, at least here in JN52) on 13-16 MHz USB bands, mainly during the morning  and seldom during weekends.
 
T-207 detection has to be manually spotted by processing the demodulated bitstream and checking if it matches the criteria described in the cited post. We have first to choose a 14 bit period for the bistream and then focus on the first 12 positions and count the amount of "1" symbols:

- if the amount counts 2 or 6 or 10: the last two symbols (13th and 14th bits) must be 10

- if 3 or 7: 00

- if 4 or 8: 11

- if 5 or 9: 01

In case the sum is 0, 1, 11 and 12, it can be assumed that the last two symbols will be 11, 01, 00 and 11, respectively. These rules are shown in tab. 1.

Tab.1 - T-207 criteria

Since the above rules act presumably as a synchronization mechanism, the signal will be decoded and decrypted once removed the columns 13 and 14.

 a) 3 x 100Bd/1440Hz VFT

fig. 1 - 3 x 100Bd/1440Hz VFT

In this signal we have three channels modulated at 100Bd and a pilot tone at ~3300 Hz (characteristic feature of Russian systems). Every channel has a 1440 Hz shift and 100 Baud speed, channels are separated by 480Hz steps and interleaved as in figure1.

In my test I used the lower channel (fig. 2).
 

fig. 2

The obtained bitstream must be processed using the right/left shift (one bit at time) and sometimes the negative polarity:  criteria of Tab. 1 must be checked in all the rows at each shift-step, in case of fails we go on shifting. Unless possible interferences and demodulator errors, I confirmd the T-207 signature (fig. 3).
 

fig. 3

https://yadi.sk/d/SlYz9x6JllZhDg

b) 6 x 100Bd/120Hz VFT

Fig.4

the 6 x 100Bd/120 system (a variant of the 3 x 100Bd/1140 system) allows six independent channels, each of them exhibits 440 Hz shift and 120 Baud speed: in this sample the one-of-six mode is used. T-207 signature was found after processing the demodulated bitstream in the usual way (figs 5,6).

fig.5

fig.6

https://yadi.sk/d/wqahxt8RDXEBoA

HF CRY-2001 (Sailor-2001) analog voice scrambler

HF CRY-2001 (Sailor-2001) uses basic rolling code inversion, the transmitted audio bandwidth is split, inverted and spaced separately at an audio frequency point which changes with each over. The short sync burst (100 Baud 170 Hz shift FSK-2) at the beginning and end of each transmission is what lets the receiving unit know at which audio frequency the split has occurred and its spacing so it can be reassembled. This transmission was heard on 6446.0 KHz on USB at 2058 UTC.

One would think that the split/spacing value is easily obtained by demodulating the FSK sync, but it's not so easy. Indeed, each CRY-2001 unit has a 6 digit key assigned to it, in normal operation a user will exchange keys with another approved operator and this key will be used to encrypt the FSK sync burst so without it anyone listening (including other CRY-2001 units), can't get the split/spacing data to reassemble it.

This system is frequently used for comunications between small fishing boats, images and docs are available on the web.

Siemens CHX200 F1-modem (CHP-200): FSK 249 & 250 Bd /170 Hz waveform

The CHX200 F1-modem (also known as CHP200 or CHP-200, i.e. the name of the embedded comunications processor) has been built in Germany by Siemens and under license in Indonesia (for domestic use).  It is part of their CHX200 family of HF ECCOM frequency hopping equipment and it has been in production since 1981. Ops 1.3-30 MHz (all mode transceiver), 10 KHz-30 MHz (receive), in 100 Hz steps. Dependent on the deployment, its RF power levels range from 100 to 1000 Watts (CHX250 1000 watt station, CHX240 400 watt station, CHX210 100 watt station). Known accessories and major items include PA-400 power amplifier, ATU-400 antenna tuning unit, PA/ATU-100 power amplifier/antenna tuner, CHP-200 receiver/exciter with communications processor.

This transission consists of the selcall part followed by the non-hopping ARQ part and was heard on 10154.0 KHz, with a +1600Hz shift on USB, at 0815 UTC. The signals belong to the FSK family, the ARQ part is characterized by a costant 250 Bd manipulation speed and a shift of 170 Hz (figs. 1a, 1b).

fig. 1a - constant 250 Baud speed

fig. 1b - ISS bursts and IRS ACKs

The most interesting feature of this FSK signal consists in the different manipulation speeds used in the two 'segments' (here indicated as A and B) of the selcall procedure. Although the CHP200 logs (at least the ones that I found) report the 250 symbols/sec speed, a more accurate analysis of the signals shows two different speeds and this could suggest the use of the 2-way ARQ mechanism.
According to the speed measurements (and to the ARQ mechanism) it seems that the sender transmits data at 250 Baud while the acknowledgements are sent back by the receive peer at 249 Baud (fig. 2).

fig. 2

One could say that it's a tollerance question since the two speeds differ in only one sybol, but the difference between the segments A and B is real and is clearly shown in figure 3 (obtained after the demodulation of the signal)

fig. 3

Other than the speeds, the two segments adopt different frame structures for their data transfer: 46 bits length (corresponding to a duration of 184ms) for the segment A and 36 bits length (144.5s) for the segment B, as shown in figs 4 and 5. Since these characteristics, I think that discussing about two distinct waveforms - rather than two segments of the same waveform - would be more appropriate.

fig. 4 - the 46 bits frame structure of the waveform A

fig. 5 - the 36 bit frame structure of the waveform B

The patterns visible in the two bistreams (fig 6) resemble data + ACKs and are another clue in favor of the ARQ.

fig. 6

Unfortunately I could not find official Siemens documentation about this modem and the selcall procedure: it would be interesting if someone could provide such info.
I want to thanks my friend Karapuz for pointing e in the right direction.
 

MIL 188-110B App. C (STANAG-4539 Annex B)

in this recording a MIL 188-141 2G-ALE link setup between ALE calls 5CIND2 and 5CIND1, and two MIL 188-110B App.C 4800bps short sessions for data transfer. The Appendix C of MIL 188-110B describes the HF data modem waveforms for data rates above 2400 bps (3200, 4800, 6400, 8000, 9600, and optional uncoded 12800 bps) and  is  defined as High Data Rate Traffic Waveforms in STANAG-4539 Annex B (the counterpart NATO compatible standard).

This transmission was spotted on 10074.0 KHz/USB @ 0710 UTC, on June 22.

There are two clues that confirm this waveform:

1) the ACF value is 119.58ms and corresponds to a frame structure consisting of 287 symbols data block consisting of 256 data symbols followed by a mini-probe of 31 symbols of known data  (188-110C Appendix D has 120ms ACF and 256 +32 = 288 symbols per data block)

fig. 1 - ACF and frame structure

2) the preamble exhibits a clear 184 symbols blocks structure 

fig. 2 - preamble

Both the two structures are also visible looking at the bistream obtained after the PSK-8 symbols demodulation: the preamble consists of 552 bits and each data frame consists of 861 bits  (fig. 3)

fig. 3

Unfortunatelly it's a poor quality signal and the constellation is not so clear, although the 8-ary modulation is quite evident in figure 4. Since the 3200bps QPSK constellation is scrambled to appear on-air as a PSK-8 constellation, we can't be positive about the data rate. Compatible decoders say 4800bps Short interleaver.

 

filg. 4 -  PSK-8 'over-the-air' constellation

According to the standard, preamble re-insertions occur each 72 data frames, thus the reinsertion period Tr is 8,61 secs (20664 symbols): since the duration of each session is <Tr (in this recording we count 36-37 data frames) we then do not see such reinsertions (they are not transmitted).

Using the PSK-8 symbol mapping, each mini-probe is based on the repeated Frank-Heimiller sequence. The sequence that is used, specified in terms of the 8PSK symbol numbers, is given by:

0, 0, 0, 0, 0, 2, 4, 6, 0, 4, 0, 4, 0, 6, 4, 2, 0, 0, 0, 0, 0, 2, 4, 6, 0, 4, 0, 4, 0, 6, 4

This mini-probe are designated ‘+’. The phase inverted version of this is:

4, 4, 4, 4, 4, 6, 0, 2, 4, 0, 4, 0, 4, 2, 0, 6, 4, 4, 4, 4, 4, 6, 0, 2, 4, 0, 4, 0, 4, 2, 0

and mini-probes using this sequence are designated ‘-’ (as the phase of each symbol has been rotated 180 degrees from the ‘+’). The 72 mini-probes before the preamble reinsertion are grouped into four sets of 18 consecutive mini-probes (1 to 18, 19 to 36, 37 to 54, and 55 to 72). Pictorially, this length 18 sequence is:

- - - - - - - + S0 S1 S2 S3 S4 S5 S6 S7 S8 +

where the Si sign values are defined in Tables C-IX, C-X, and C-XI of MIL 188-110B. No scrambling is applied to the mini-probes symbols.

Since the low quality of the recording and the characteristics of the SA universal PSK demodulator, we can just apreciate a "nuance" of the mini-probe pattern (fig. 5). Maybe further and better recordings will help.

fig. 5 - 188-110B App.C mini-probes

'Echotel 1810' and 'THALES TRC-1752': same PSK-8 2400Bd, same 768 bits ACF, but two different waveforms

Single tone PSK-8/2400Bd waveforms are very common and it's easy to get mistakes in their identification, sometimes also their ACF values are equal and so things get complicated (it could also happen that the same waveform exhibits different ACFs according to the input data signaling rate). In cases of uncertainty or ambiguity, a careful examination may decide the questions.
Below just an example about  the Thales TRC-1752 and Echotel 1810 "signals": they not only have the same PSK-8 2400Bd single tone features but also the same ACF. Note that althought both Thales TRC-1752 and Echotel 1810 are HF modems (to be clear: MAHRS - Multiple Adaptive HF Radio System is an "operating mode", Arcotel is the radio processor)  I  generically refer to both as "signals".

Looking at their representation in the waterfall, they have a quite similar shape characterized by the same bandwidth, a non-fixed length duration and a short preamble: a first difference is visible just in this part. Looking with a little more attention, the Echotel preamble is composed of 8+8 simmetrical tones while Thales signal exhibits a different header (fig. 1).

fig. 1

The data transfer parts of the two signals share the same features: 8-ary phase-shift keying of a single 1800 Hz carrier and 2400 symbols/sec modulation rate (input data signaling rate is not detected here). It's interesting to note the pronounced BPSK states that, unless their phase shift, appear in both the constellations of the two signals (fig. 2).

fig. 2

These footprints suggest the presence of BPSK segments in the structure of both the two signals. As from literature, they consist of known-data symbols, in contrast with the unknown (user) data, and are are scrambled to appear, on-air, as PSK-8 symbols.
The BPSK insertions, as well as the differences between the two preambles, are more evident reducing the FFT size in the waterfall (fig. 3).

fig. 3

Looking at the two waterfalls, both with the same settings, we can also estimate that the two signals have the same pattern repetition rate (pic.3). Running the ACF and CCF functions for a better accuracy of the repetition rate, we get the same 106.665 ms result for both the signals: this value makes 768 tri-bits, or 256 PSK-8 symbols periods since the manipulation speed is 2400Bd.
At this point, the real difference between these two signals, unless the preamble, can only be found by examining their frame structures.

The frame structure for the Echotel signal is shown in figure 4. The preamble is followed by 256 symbols blocks, each block consisting of 176 unknown data symbols and a mini-probe consisting of 80 symbols of known data.

fig. 4 - frame structure for Echotel

 

The frame structure for the Thales signal is shown in figure 5. As well as in the frame of Echotel signal, the frame cosists of 256 symbols blocks, each block consisting of 80 symbols preamble followed by 176 symbols data block, each data block consisting of 4 x 32 unknown data symbols and 3 x 16 symbols mini-probes (S4285-like waveform).

fig. 5 - frame structure for THALES TRC-1752

 

It's worth noting that the two signals have the same length, 80 symbols, for the BPSK modulated  segment.